32
Kathy Garceau, Examiner-in-Charge John Buyce, Audit Director NYS OSC - State Government Accountability
Kathy Garceau, Examiner-in-Charge John Buyce, Audit Director
NYS OSC - State Government Accountability
Internal Controls in New York State In 1987, the Legislature passed the New York State
Governmental Accountability, Audit and Internal Control Act (Act) requiring each State agency to institute a comprehensive system of internal controls over its operations.
The Division of the Budget’s (DOB’s) Budget Policy and Reporting Manual Bulletin B-350 requires the head of each covered agency to certify compliance with the Act by April 30 of each year by submitting a Certification and Internal Control Summary describing the internal control activities undertaken during the previous year.
The Comptroller’s Responsibilities Under the Internal Control Act
Objective is to help public sector managers safeguard public assets and promote accountability in government. Responsibilities are:
Issuing standards for internal control,
Providing technical assistance to agencies and
Conducting audits of internal controls.
Past Audits by the Comptroller
Past audits conducted by the Comptroller have examined a range of topics from specific control systems at individual agencies to broader statewide issues like the operation of internal audit units.
Comptroller Audits in 2012 A series of audits focused specifically on the Internal
Control Certification process and whether State agencies have:
1. Submitted their certifications on time,
2. Properly answered all the questions with the appropriate level of detail, and
3. Maintained documentation that supports the answers given.
Why ask these questions?
Certification is the basic tool that those charged with governance can use to assess agency compliance with the Act.
Answers also provide insight not only about the adequacy of internal control systems, but also about the Control Environment at the agency and its commitment to making information available for accountability in a manner that is timely, informative and reliable.
Audit Methodology
Examined all the Certifications for timeliness and completeness
Selected a cross-section of a dozen agencies for follow-up and verification
Overall Timeliness
Sixty-One agencies were required to file Certifications
for 2011-12. Almost half did not file on time.
21 (1/3) filed, but did not meet the April 30 deadline.
8 others still hadn’t filed their certifications by the end of 2012.
On Time 53%
Late 34%
Not Filed 13%
Timeliness of 2012 Certifications
As of December 31, 2012
Overall Certification Completeness
Good news is – everyone who filed answered all the questions and rated their compliance in each area.
However, on first review, at least 9 did not provide the required level of detail to explain what they did to comply, particularly in the area of training efforts.
Agency Training Programs Requirement: Implement education and training efforts to ensure
that officers and employees have achieved adequate awareness and understanding of internal control standards and as appropriate, evaluation techniques.
Guidance: Agencies should identify staff requiring training and the depth and content… …training should be ongoing with specific courses directed at (various levels).
Instructions: Provide a thorough explanation of the specific actions your agency has taken, or which are needed, to comply with this requirement.
Some Responses…………. Staff have online resources available and
managers recommend refreshers as situations and agency changes dictate.
Internal Control guidance is ongoing as operations are monitored and evaluated by executive management. A series of guidance documents provided to managers was communicated in last year’s report.
Agencies Selected for Audit Agriculture & Markets
Economic Development
Education
Department of State
State Police
Mental Health
Medicaid IG
Welfare IG
Housing & Community Renewal (NY Homes)
Office for People with Developmental Disabilities
Parks, Recreation & Historic Preservation
Office for Prevention of Domestic Violence
Best Practices Gold Stars
Medicaid Inspector General
Welfare Inspector General
Silver Stars
Office for Persons with Developmental Disabilities
State Education Department
Timeliness
All of the agencies we visited filed their certifications for 2012, but 4 did not meet the April 30 deadline.
Late filings occurred in May, June, July and September
Completeness
7 of the 12 agencies did not provide the required level of detail for all questions.
Problems were focused across several areas
Results of reviews of high-risk areas
Review & testing of controls,
Monitoring of corrective actions
Internal audit planning
High-Risk Areas
Guidance: …list all high-risk activities which were
reviewed during the past year, and the results of those reviews.
3 agencies listed their high-risk areas, but did not discuss the results of their reviews
1 agency discussed its review methodology, but did not list risk areas or discuss results of any reviews
Reviewing & Testing Controls Monitoring Corrective Action
Guidance: In addition to providing a thorough
explanation of the specific actions your agency has taken …to comply with this requirement, please describe briefly your agency’s process for reviewing and testing controls and monitoring corrective actions.
Two agencies did not describe their review and testing procedures.
Three did not explain how they monitored corrective actions.
Internal Audit Planning Guidance: Agencies should specifically provide the
following information when presenting their explanation: (11 items listed)
#6 - A copy of the 2012-13 internal audit plan.
7 of the 12 agencies we visited had Internal Audit units; 1 did not attach a copy of its audit plan
Supporting Documentation Auditors examined the records that agencies retained to
support their answers to the Certification questions.
Several agencies could not provide records to support at least one of their answers to critical questions.
A couple had records that contradicted statements made in their Certifications.
Missing Documentation Agencies were unable to show examples of how or
when management had communicated to the organization about internal controls.
Agencies did not retain training records, or were otherwise unable to show what training had been provided to which types of employees (e.g. Line Staff, Managers, Executives) and when.
Agencies described processes for review and follow up, but did not retain documentation that showed these informal activities really occurred.
Contradictory Documentation One agency claimed to be in full compliance with the
requirement for a program of internal control review.
Documentation showed the ICO:
had yet to review many of the unit self assessments,
had not conducted any verification, and
had taken no steps to determine the status of corrective action plans.
Contradictory Documentation Another agency certified full compliance with the
training requirements of the Act.
Documentation showed it had not provided internal control training to employees since Fiscal 2009-10 – two years before the certification year.
Contradictory Documentation An agency reported a fully compliant system in place
to test, track and monitor both risk assessments and corrective actions.
Documentation showed control tests by unit staff as part of the risk assessment process, but no central testing of those assessments.
A database existed that listed all audit and review findings, but no evidence of monitoring or follow-up.
Other Items That May Impact Compliance
The objective of our audits was not to evaluate agency compliance with the Act.
However, at 7 of the 12 agencies we visited, we also noted issues that call into question the degree of agencies’ compliance with specific provisions.
Our reports bring these issues to management’s attention for further consideration.
Potential Compliance Issues 3 agencies reported that they were fully compliant with the
education and training provisions of the Act, although their descriptions of what they provided, and to whom, indicated only partial compliance.
3 other agencies reported that their internal audit units complied with IIA standards despite never having had an external quality assessment.
Potential Compliance Issues
Two agencies had the same person functioning as Internal Control Officer and Internal Audit Director.
Another had the Internal Audit Director report to the Internal Control Officer, rather than to the head of the agency.
Audit Recommendations 1. Re-examine agency priorities to accommodate timely
submission of the Internal Control Certification.
2. Provide appropriately detailed responses to questions as requested in the annual Internal Control Certification.
3. Ensure all statements contained in the Internal Control Certification are supported by sufficient and appropriate documentation.
4. Ensure that compliance testing and monitoring systems are in place. When necessary, ensure corrective action is taken and monitored.
5. Ensure that the internal audit function undergoes required external quality assessments.
Options for 2014 and Beyond Monitor and review the 2013 submissions, looking
improvements in areas like:
Timeliness,
Completeness and required detail, and
Issues potentially impacting compliance.
Options for 2014 and Beyond May also look deeper into what agencies are doing to
validate their risk assessments and test their controls.
Agency validation has a lot of similarities to these audits
Are assessments Timely, Accurate, Supported by Documentation?
Are any other unreported risks apparent?
Good opportunity for us to identify Best Practices
Options for 2014 and Beyond May also begin examining how the agencies are
addressing each of the five components of internal control.
How have we moved beyond a focus just on Monitoring and Risk Assessment, or Control Activities?
How are we considering Information & Communications system?
How are we evaluating the Control Environment?
Questions & Contacts View the reports @www.osc.state.ny.us
Kathy Garceau John Buyce
(518) 474-3271 (518) 473-8757
